fix(credential-groups): raise OAuth code cap so Atlassian callbacks validate (#7422)

* fix(credential-groups): raise OAuth code cap so Atlassian callbacks validate

The managed credential-group callback capped the OAuth `code` query param at
2048 characters. That bound was sized when the flow only supported Slack, whose
authorization codes are short, and was never revisited as more providers were
added. Providers that return a signed JWT as the authorization code exceed it,
so the callback rejected the exchange with a validation error before it ran.

Share a single MAX_OAUTH_CODE_LENGTH (8192) from the contract primitives and use
it on both callback paths, so the two contracts cannot drift apart again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013e5sXbYST2R4qNzM996GFg

* fix(credential-groups): correct the OAuth code bound's doc comment

The constant's comment claimed every callback contract shares the bound, but the
Shopify and MCP callback schemas leave `code` unbounded. Describe what the bound
is and why it is sized as it is, without asserting an adoption scope that would
go stale as contracts are migrated onto it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013e5sXbYST2R4qNzM996GFg

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/api/contracts/credential-groups.test.ts

@@ -5,6 +5,7 @@ import {
   credentialGroupAccessResponseSchema,
   credentialGroupEnrollmentDetailSchema,
   credentialGroupEnrollmentListQuerySchema,
+  credentialGroupOAuthCallbackQuerySchema,
   credentialGroupSchema,
   inviteCredentialGroupEnrollmentsBodySchema,
   sharedCredentialGroupOAuthCallbackContract,
@@ -292,4 +293,22 @@ describe('credential group contracts', () => {
       }).success
     ).toBe(false)
   })
+
+  it('accepts an Atlassian-sized authorization code', () => {
+    const parsed = credentialGroupOAuthCallbackQuerySchema.safeParse({
+      state: `cg_${'a'.repeat(36)}`,
+      code: 'a'.repeat(4096),
+    })
+
+    expect(parsed.success).toBe(true)
+  })
+
+  it('still rejects an unbounded authorization code', () => {
+    const parsed = credentialGroupOAuthCallbackQuerySchema.safeParse({
+      state: `cg_${'a'.repeat(36)}`,
+      code: 'a'.repeat(8193),
+    })
+
+    expect(parsed.success).toBe(false)
+  })
 })

apps/sim/lib/api/contracts/credential-groups.ts

@@ -1,5 +1,9 @@
 import { z } from 'zod'
-import { workflowIdSchema, workspaceIdSchema } from '@/lib/api/contracts/primitives'
+import {
+  MAX_OAUTH_CODE_LENGTH,
+  workflowIdSchema,
+  workspaceIdSchema,
+} from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import {
   CREDENTIAL_GROUP_MCP_SERVER_LIMIT,
@@ -234,7 +238,7 @@ export const startCredentialGroupMcpOAuthParamsSchema =
 export const credentialGroupOAuthCallbackQuerySchema = z
   .object({
     state: z.string().min(1, 'OAuth state is required').max(512),
-    code: z.string().min(1).max(2048).optional(),
+    code: z.string().min(1).max(MAX_OAUTH_CODE_LENGTH, 'Authorization code is too long').optional(),
     error: z.string().min(1).max(256).optional(),
     error_description: z.string().max(1000).optional(),
   })

apps/sim/lib/api/contracts/oauth-connections.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { workspaceIdSchema } from '@/lib/api/contracts/primitives'
+import { MAX_OAUTH_CODE_LENGTH, workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import type {
   ContractBody,
   ContractBodyInput,
@@ -223,7 +223,6 @@ export const trelloCallbackContract = defineRouteContract({
 })
 
 const MAX_OAUTH_RETURN_URL_LENGTH = 2048
-const MAX_OAUTH_CODE_LENGTH = 8192
 const MAX_OAUTH_STATE_LENGTH = 256
 const MAX_OAUTH_ERROR_LENGTH = 2048
 

apps/sim/lib/api/contracts/primitives.ts

@@ -237,6 +237,17 @@ export function withMissingFieldMessage<TSchema extends z.ZodString>(
  */
 export const MAX_ID_LENGTH = 128
 
+/**
+ * Bound for an OAuth `code` callback parameter.
+ *
+ * Authorization codes have no length ceiling in RFC 6749, and providers differ by
+ * orders of magnitude: Slack's are tens of characters while Atlassian returns a
+ * signed JWT that routinely exceeds 2KB. The bound exists to keep an unbounded
+ * string out of a token exchange, so it is sized above the largest real code
+ * rather than around any one provider.
+ */
+export const MAX_OAUTH_CODE_LENGTH = 8192
+
 /**
  * Builds a required, non-empty string schema whose message covers **both**
  * failure modes.